Http Technical Info Leak
Description
This detector identifies exposed Spring Boot Actuator and Prometheus metrics endpoints that leak technical information about the application without requiring authentication.
Detection Strategy
• Makes GET requests to six well-known monitoring endpoints (/actuator/env, /actuator/beans, /actuator/mappings, /actuator/metrics, /actuator, /metrics) concurrently, without following redirects
• Requires a 200 response before inspecting the body
• For /actuator/env, parses the JSON body and reports a vulnerability only when a property whose name looks like a secret (password, api_key, token, etc.) carries a value that is not masked or redacted
• For the other five endpoints, matches the response body against a signature specific to that endpoint's known structure (Spring Boot actuator JSON shape or Prometheus text-exposition format)
• Reports one vulnerability per endpoint that matches, not just the first
Search for vulnerabilities in your apps for free with Fluid Attacks' automated security testing! Start your 21-day free trial and discover the benefits of the Continuous Hacking Essential plan. If you prefer the Advanced plan, which includes the expertise of Fluid Attacks' pentesting team, fill out this contact form.